Index: util-linux-2.39.3/sys-utils/mount.8
===================================================================
--- util-linux-2.39.3.orig/sys-utils/mount.8
+++ util-linux-2.39.3/sys-utils/mount.8
@@ -205,6 +205,20 @@ Since util\-linux 2.35, \fBmount\fP does
 For more details, see \fBfstab\fP(5). Only the user that mounted a filesystem can unmount it again. If any user should be able to unmount it, then use \fBusers\fP instead of \fBuser\fP in the \fIfstab\fP line. The \fBowner\fP option is similar to the \fBuser\fP option, with the restriction that the user must be the owner of the special file. This may be useful e.g. for \fI/dev/fd\fP if a login script makes the console user owner of this device. The \fBgroup\fP option is similar, with the restriction that the user must be a member of the group of the special file.
 .sp
 The \fBuser\fP mount option is accepted if no username is specified. If used in the format \fBuser=someone\fP, the option is silently ignored and visible only for external mount helpers (/sbin/mount.<type>) for compatibility with some network filesystems.
+.if n .sp
+.RS 4
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+.B Warning
+.ps -1
+.br
+.sp
+When using the legacy \fBmount\fP(2) syscall (on older kernels without the new mount API), the mount target path is resolved by the kernel at syscall time. This means there is an inherent time\-of\-check\-to\-time\-of\-use (TOCTOU) window between the permission verification and the actual mount operation. If an ancestor directory of the mount target is writable by the unprivileged user, a path component could be swapped to redirect the mount to an unintended location. The new mount API (available since Linux 5.2) eliminates this issue by using file\-descriptor\-based target resolution. Administrators should ensure that mount target paths for \fBuser\fP mounts do not traverse directories writable by unprivileged users.
+.sp .5v
+.RE
 .SS Blacklisted file systems
 In the Linux kernel, file system types are implemented as kernel
 modules. While many of these file systems are well maintained,
@@ -404,6 +418,8 @@ Remount a subtree somewhere else (so tha
 Don\(cqt canonicalize paths. The \fBmount\fP command canonicalizes all paths (from the command line or \fIfstab\fP) by default. This option can be used together with the \fB\-f\fP flag for already canonicalized absolute paths. The option is designed for mount helpers which call \fBmount \-i\fP. It is strongly recommended to not use this command\-line option for normal mount operations.
 .sp
 Note that \fBmount\fP does not pass this option to the \fB/sbin/mount.\fP\fItype\fP helpers.
+.sp
+Note that \fBmount\fP ignores this option for unprivileged (non\-root) users. Paths are always canonicalized in restricted mode to ensure safe target resolution.
 .RE
 .sp
 \fB\-F\fP, \fB\-\-fork\fP
@@ -1002,6 +1018,8 @@ Allow mounting sub\-directory from a fil
 .sp
 Note that this feature will not work in session with an unshared private mount namespace (after \fBunshare \-\-mount\fP) on old kernels or with \fBmount\fP(8) without support for file\-descriptors\-based mount kernel API. In this case, you need \fBunshare \-\-mount \-\-propagation shared\fP.
 .sp
+For unprivileged (non\-root) users, this feature is currently not supported.
+.sp
 This feature is EXPERIMENTAL.
 .RE
 .sp